Fuzzing API to identify API1: broken object level authorization control

on YouTube ↗23m

" summary

Fuzzing identifies API1 broken object-level authorization and API5 broken function-level authorization by iterating ID patterns and replacing body values derived from the OpenAPI spec, flagging endpoints that return 200 or 500 instead of 4xx. Uses open source tools like Wfuzz and OWASP ZAP, integrates generation-based fuzzing into DevSecOps (scheduled off-peak), separates QA from security testing, and experiments with machine learning to improve test-vector accuracy and raise true-positive rates.

AI-written summary · about

" chapters (9)

1. 0:00Intro
2. 3:28Agenda
3. 3:47Recent Incidents
4. 5:01Access Control
5. 7:28API 5 and API 1
6. 11:08How can we identify
7. 13:02Fuzzy factor type
8. 15:19Fuzzing procedure
9. 18:32Open source fuzzing tool

" related talks

• 46mAutomating API Penetration Testing using fuzzapiAbhijeth Dugginapeddi, Lalith Rallabhandi · AppSecUSA 2016
• 45mFuzz Testing Web APIs: Overview of Existing ToolsAndrea Arcuri · TestCon Europe 2025
• 49mData sources for fuzzing web application APIsVsevolod Dergunov · Saint HighLoad++ 2025
• 35mHow to Break API'sInon Shkedy · OWASP Global AppSec Virtual 2020
• 26mOffensive API Penetration TestingSunny Singh · apidays Hong Kong 2022
• 25mOWASP Top 10 for APIsInon Shkedy · apidays New York 2020
• 46mAPI Security – Divide & ConquerTom Zahov Zaubermann · 4Developers 2021
• 53mFuzz Testing for Fun and ProfitMELISSA BENUA · BSides Huntsville 2021